Passive sources for the Bennett-Brassard 1984 quantum key distribution protocol 

with practical signals 
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Most experimental realizations of quantum key distribution are based on the Bennett-Brassard 
1984 (so-called BB84) protocol. In a typical optical implementation of this scheme, the sender 
uses an active source to produce the required BB84 signal states. While active state preparation 
of BB84 signals is a simple and elegant solution in principle, in practice passive state preparation 
might be desirable in some scenarios, for instance, in those experimental setups operating at high 
transmission rates. Passive schemes might also be more robust against side-channel attacks than 
active sources. Typical passive devices involve parametric down-conversion. In this paper, we show 
that both coherent light and practical single photon sources are also suitable for passive generation 
of BB84 signal states. Our method does not require any external-driven element, but only linear 
optical components and photodetectors. In the case of coherent light, the resulting key rate is 
similar to the one delivered by an active source. When the sender uses practical single photon 
sources, however, the distance covered by a passive transmitter might be longer than the one of an 
active configuration. 

PACS numbers: 



I. INTRODUCTION 



The transmission of secret information over an insecure 
communication channel constitutes an essential resource 
in modern information society. Quantum key distribu- 
tion (QKD) is a technique that allows two distant par- 
ties (typically called Alice and Bob) to establish a secure 
secret key despite the computational and technological 
power of an eavesdropper (Eve), who interferes with the 
signals [lj . This secret key is the main ingredient of the 
one-time-pad or Vernam cipher 0, the only known en- 
cryption method that can deliver information-theoretic 
secure communications. 

Most experimental realizations of QKD arc based on 
the so-called BB84 QKD scheme introduced by Ben- 
nett and Brassard in 1984 ||. In a typical quantum 
optical implementation of this protocol, Alice sends to 
Bob phase-randomized weak coherent pulses (WCP)with 
usual average photon number of 0.1 or higher [3, @- 
These states can be easily generated using only standard 
semiconductor lasers and calibrated attenuators. Each 
light pulse may be prepared in a different polarization 
state, which is selected, independently and randomly for 
each signal, between two mutually unbiased bases, e.g., 
cither a linear (H [horizontal] or V [vertical]) or a circular 
(L [left] or R [right]) polarizations basis. On the receiving 
side, Bob measures each incoming signal by choosing at 
random between two polarization analyzers, one for each 
possible basis. Once this quantum communication phase 
is completed, Alice and Bob use an authenticated public 
channel to process their data and obtain a secure secret 



key. This last procedure, called key distillation, involves, 
typically, local randomization, error correction to recon- 
cile Alice's and Bob's data, and privacy amplication to 
decouple their data from Eve [f| . A full proof of the se- 
curity for the BB84 QKD protocol with WCP has been 
given in Refs. @, The performance of this scheme can 
be improved further if the original hardware is slightly 
modified. For instance, one can use the so-called decoy- 
state method 

003, where Alice varies the mean photon 
number of each signal state she sends to Bob. The mea- 
surement results associated to different intensity settings 
allow the legitimate users to obtain a better estimation 
of the behavior of the quantum channel. This translates 
into an enhancement of the achievable secret key rate, 
which can now basically reach the performance of single 
photon sources (SPS). 

The preparation of the BB84 signal states is usually 
realized by means of an active source. For simplicity, 
we will first consider polarization encoding. (Note that 
phase encoding is mathematically equivalent to polar- 
ization encoding. Later in this paper, we will also con- 
sider phase encoding.) There are two main configura- 
tions; they are illustrated in Fig. Q]as cases A and B. In 
the first one (case A in the figure), Alice uses four laser 
diodes, one for each possible BB84 signal JH . These lasers 
are controlled by a random number generator (RNG) [llj 
that decides each given time which one of the 4 diodes 
is triggered. The second configuration (case B in the fig- 
ure) uses only one single laser diode in combination with 
a polarization modulator which is controlled by a RNG 
Q. This modulator can rotate the state of polarization 
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FIG. 1: (Case A) Example of an active setup with four laser 
diodes controlled by a random number generator (RNG). 
Each source emits one different BB84 signal state {e.g., H 
[horizontal], V [vertical], L [circular left] or R [circular right] 
polarization states). BS denotes a beamsplitter. (Case B) Ex- 
ample of an active setup with one laser diode together with 
a polarization modulator controlled by a RNG. This modu- 
lator rotates the state of polarization of the incoming pulses 
to generate BB84 signal states. (Case C) Basic setup of a 
passive QKD transmitter with linear optics elements. One 
or more laser diodes produce different signal states that are 
sent through a linear optics network. Depending on the de- 
tection pattern observed in the detectors Di, different signal 
states are actually generated. No RNG or active modulator 
are necessary in this last scenario. 



of the signals produced by the source. 

While active state preparation is a simple and elegant 
solution to implement the BB84 protocol in principle, in 
practice passive state preparation might be desirable in 
some scenarios [l2T - ll4j |: for instance, in those experimen- 
tal setups operating at high transmission rates, since no 
RNG is required in a passive device. A passive trans- 
mitter allows Alice to generate different quantum states 
at random without the need to use an external source 
of randomness. This situation is illustrated as case C in 
Fig. Q] Alice can use one or more light sources to pro- 
duce different signal states that are sent through a linear 
optics network. Depending on the detection pattern ob- 
served in her detectors Di, she can infer which signal 
states are actually generated. So far, only entanglement- 
based (EB) QKD systems have been designed to oper- 
ate entirely in a passive regime without any external- 
driven elements [HI, EE]. For instance, Alice and Bob 
can use a beamsplitter (BS) to passively and randomly 
select which bases to measure each incoming pulse. In 
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FIG. 2: Basic setup of a passive BB84 QKD source with 
strong coherent light. The mean photon number of the signal 
states p+45° and p_4so can be chosen very high; for instance, 
~ 10 8 photons. The parameter t represents the transmittance 
of the BS; it satisfies t <C 1. 



this article, we show that both coherent light and practi- 
cal SPS are also suitable for passive generation of BB84 
signal states, i.e., one does not need a nonlinear optics 
network preparing entangled states in order to passively 
generate BB84 signals. Practical SPS (also called "sub- 
Poissonian sources" ) are those light sources which have a 
smaller probability of emitting two or more photons than 
an attenuated laser. Our method requires only linear 
optical elements and photodetectors. In the asymptotic 
limit of an infinite long experiment, it turns out that the 
secret key rate of a passive source with coherent light is 
similar to the one delivered by an active source. When 
Alice uses practical SPS, however, the distance covered 
by a passive transmitter might be longer than the one 
of an active configuration. This result is caused by the 
capacity of the passive scheme to reduce the multiphoton 
probability of the source via a post-selection mechanism. 

Passive schemes might also be more robust than active 
systems to side-channel attacks hidden in the imperfec- 
tions of the optical components. If a polarization modu- 
lator is not properly designed, for example, it may distort 
some of the physical parameters of the pulses emitted by 
the sender depending on the particular value of the polar- 
ization setting selected. This fact could open a security 
loophole in the active schemes. 

The article is organized as follows. In Sec.|TI]we present 
and evaluate the performance of a passive BB84 state 
preparation scheme that can operate with coherent light. 
Then, in Sec. IIIII we consider the case where Alice uses 
practical SPS. Finally, Sec. II VI concludes the article with 
a summary. The paper includes as well a few appendixes 
with additional calculations. 



II. PASSIVE TRANSMITTER WITH 
COHERENT LIGHT 



The basic setup is rather simple. It is illustrated in 
Fig. [21 Suppose two phase-randomized strong coher- 
ent pulses prepared, respectively, in +45° and —45° lin- 
ear polarization, interfere at a polarizing beamsplitter 
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(PBS). These states can be written as 
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where |n±45°) denote Fock states with n photons in ±45° 
linear polarization. The mean photon number, v/2, of 
each signal can be chosen very high; for instance, as 10 8 
photons. In this scenario, we will show that the signal 
"out a t the output port of the PBS can be expressed as 



Cout 



n=0 



\ng)(ng\ d8, 



where the Fock states \ng) are given by 
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Here \vac) denotes the vacuum state, and ci_j_4^o are 
the creation operators for the ±45° linear polarizations 
modes. 

To sec this, let us consider the interference of two pure 
coherent states with fixed phase relation and orthogonal 
polarizations, \y/v /2e I<?il ) +450 and |\/w/2e^ 2 )_ 450 , at a 
PBS. The output signal is a coherent state of the form 
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with 8 = cpi — cf>2 ■ The case of two phase-randomized co- 
herent pulses can be solved by just integrating the signal 
W v ~ e ^ 2 )g over all angles 4>2 and 8, i.e., 
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Now, to prepare the signal states that are sent to Bob, 
Alice performs a polarization measurement followed by 
a post-selection step. By assumption, we have that the 
intensity v of the signals a ou t is very high. Therefore, 
Alice can always employ, for instance, a BS of very small 
transmittance (t *C 1) to split these states into two light 
beams: one very weak suitable for QKD, and one strong. 
The weak signal is sent to Bob through the quantum 
channel (see Fig. [2]). The strong beam is used to measure 
its polarization by means of a polarization measurement 
which, for simplicity, we assume is perfect. For each in- 
coming signal, this device provides Alice with a precise 
value for the measured angle 8. In this situation, the con- 
ditional states emitted by the source can be described as 
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FIG. 3: Graphical representation of the valid regions for the 
angle 6. These regions are marked in grey. They depend on 
an acceptance parameter Q. £ [0, 7r/4]. 



where 8 denotes the value of the angle obtained by Alice's 
polarization measurement, and is given by fx = vt. In 
practice, however, as we will show below, it is sufficient 
if the polarization measurement tells Alice the value of 8 
within a certain interval. 

Whenever 8 € {0,7r/2,7T,37r/2} Alice generates one of 
the four BB84 polarization states perfectly. Note that 
the creation operators for the polarizations modes in the 
BB84 protocol, which we shall denote as b H , by, b L and 
bft, can be expressed, in terms of the operators aj_ 45 o , as: 
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In general, Alice docs not need to restrict herself to 
only those events where she actually prepares a perfect 
BB84 state, since the probability associated with these 
ideal events tends to zero. Instead, she can also accept 
signals with a polarization sufficiently close to the desired 
ones. This situation is illustrated in Fig. [31 where Alice 
selects some valid regions for the angle 8. These regions 
are marked with grey color in the figure. They depend on 
an acceptance parameter f2 S [0,7r/4] that we optimize. 
Specifically, whenever the value of 8 lies within any of 
the intervals ip ± (vr/4 - fl) with V € {0, tt/2, tt, 3tt/2}, 
then Alice considers the pulse emitted by the source as a 
valid signal. This last condition can also be written as 



8e |J [(2t + i)^ + n,(2i + 3)^-n 



(8) 



Otherwise, the pulse is discarded afterwards during the 
post-processing phase of the protocol, and it does not 
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contribute to the key rate. The probability that a pulse 
is accepted, p acc , is given by 
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To increase this probability, one can reduce the value 
of fi. Note, however, that this action also results in an 
increase of the quantum bit error rate (QBER) of the 
protocol, that we shall denote as E. On the other hand, 
when O increases, we have that bothp acc and E decrease. 
There is a trade-off on the acceptance parameter O. A 
high acceptance probability p acc favors O ss 0, whereas a 
low QBER favors fi ps ir/4. Note that in the limit where 
fi tends to 7r/4 we recover the standard BB84 protocol. 



A. Lower bound on the secret key rate 

The single photon signals emitted by the passive source 
presented above, averaged over the values of Alice's key 
bit, are basis-independent. That is, they do not leak 
any information to Eve about the basis of Alice's signal 
states. To see this, note that 

-n f^f- n 

\U)(U\ d9 + \l e )(U\ d9 
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for all O € [0, 7r/4], and where the single photon state 

is given by Eq. Here 1 denotes the identity operator 

in the single photon subspace. 

To evaluate the performance of this passive source 
we use the security analysis provided by Gottesman- 
Lo-Lutkenhaus-Preskill (GLLP) in Ref. Q. See also 
Ref. [l6|. It considers that Eve can always obtain full 
information about the part of the key generated from the 
multiphoton signals. This pessimistic assumption is also 
true for the passive transmitter illustrated in Fig. [2] when 
Alice and Bob use only unidirectional classical communi- 
cation during the public-discussion phase of the protocol. 
This result arises from the fact that all the photons con- 
tained in a pulse are prepared in the same polarization 
state and, therefore, no secret key can be distilled with 
one-way post-processing techniques [l7j]- Note, however, 
that such security analysis could leave still room for im- 
provement when Alice and Bob employ two-way classical 
communication. In this situation, it might be possible to 
obtain secret key even from the multiphoton pulses since 
the signal states prepared by the passive device are al- 
ready mixed at the source. This last scenario, however, 
is beyond the scope of this paper. 

We further assume the typical initial post-processing 
step in the BB84 protocol, where double click events are 
not discarded by Bob, but they are randomly assigned to 



single click events 
can be written as 




The secret key rate formula 



R > ffl>acc{(Q-JWti)[l--ff(^l)] 

- Qf(E)H(E)}. (11) 

The parameter q is the efficiency of the protocol (q = 1/2 
for the standard BB84 protocol, and q ps 1 for its efficient 
version |2(|); Q is the gain, i.e., the probability that Bob 
obtains a click in his measurement apparatus when Alice 
sends him a signal state; f(E) is the efficiency of the 
error correction protocol as a function of the error rate 
E [U, typically f(E) > 1 with Shannon limit f(E) = l; 
H(x) is the binary Shannon entropy function defined as 
H(x) = -xlog 2 (x) - (1 - a;)log 2 (1 - x)\ p mu i t i is the 
multiphoton probability of the source, i.e., 



fWti = 1 - e p (l + n); 



(12) 



and E\ denotes an upper bound on the single photon 
error rate. In the case of the standard BB84 protocol 
without decoy-states, this last quantity is given by [|| 



Ei 



E 



1 



(13) 



For simulation purposes we use the channel model and 
detection device on Bob's side described in Appendix [A"l 
This model allows us to calculate the observed experi- 
mental parameters Q and E. These quantities are given 
in Appcndix[Bj Our results, however, can also be applied 
to any other quantum channel or detection setup, as they 
depend only on the observed gain and QBER. 

The resulting lower bound on the secret key rate is 
illustrated in Fig. @] (dashed line). In our simulation 
we employ the following experimental parameters: the 
dark count rate of Bob's detectors is ee = 1 x 10~ 6 , 
the overall transmittance of his detection apparatus is 
?7b =0.1, and the loss coefficient of the quantum channel 
is a = 0.2 dB/km. We further assume that q = 1/2, 
and f(E) = 1.22. These data are used as well for the 
simulations included in Sec. Mil With this configuration, 
it turns out that the optimal value of the mean photon 
number \i decreases with the distance, while the value 
of the parameter O increases. In particular, fi dimin- 
ishes from ps 0.084 to approximately 4 x 10~ 3 , while O 
augments from ss 0.365 to ps 0.76. This result is not sur- 
prising. At long distances the gain Q of the protocol is 
very low and, therefore, it is especially important to keep 
both the multiphoton probability of the source, and the 
intrinsic error rate of the signals p Q ut,e, also low. Fig. [4] 
includes an inset plot with the optimized parameters fi 
(dashed line) and O (solid line). This figure shows as 
well a lower bound on the secret key rate for the case 
of an active source. The cutoff point where the secret 
key rate drops down to zero is basically the same in both 
cases. It is given by I ps 67.5 km. This result arises from 
two main limiting factors: the multiphoton probability 
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FIG. 4: Lower bound on the secret key rate R given by 
Eq. {TT} in logarithmic scale for the passive source illustrated 
in Fig. [2] (dashed line). The signal states p ut,e are given by 
Eq. ([6]). For simulation purposes, we consider the following 
experimental parameters: the dark count rate of Bob's de- 
tectors is £b = 1 x 1CP 6 , the overall transmittance of Bob's 
detection apparatus is r]B = 0.1, the loss coefficient of the 
channel is a = 0.2 dB/km, q = 1/2, and the efficiency of 
the error correction protocol is f(E) — 1.22. The solid line 
represents a lower bound on 7? when Alice employs an active 
source. The inset figure shows the value for the optimized 
parameters fi (dashed line) and f2 (solid line) in the passive 
setup. 



of the source, and the dark count rate of Bob's detectors. 
Note that in these simulations we do not consider any 
misalignment effect in the channel or in Bob's detection 
apparatus. From the results shown in Fig. [4] we see that 
the performance of the passive scheme is similar to the 
one of an active setup, thus showing the practical inter- 
est of the passive source. The (relatively small) difference 
between the achievable secret key rates in both scenarios 
is due to two main factors: (a) the probability p acc to 
accept a pulse emitted by the source, which is p acc < 1 
in the passive setup, and p acc = 1 in the active scheme, 
and (b) the intrinsic error rate of the signals accepted by 
Alice, that is zero only in the case of an active source. 



B. Alternative implementation scheme 

The passive setup shown in Fig. [2] requires that Alice 
employs two independent sources of phase-randomized 
strong coherent pulses. Alternatively to this scheme, Al- 
ice could as well employ, for instance, the device illus- 
trated in Fig. [5] This setup has only one laser diode, but 
follows a similar spirit like the original scheme shown 
in Fig. [5J where a polarization measurement is used to 
determine the polarization of the incoming signals. The 
main idea is just to replace two single light pulses emitted 
by two different diodes with two consecutive light pulses 
generated by only one laser diode. 

To keep the analysis simple, the scheme includes as 
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FIG. 5: Alternative implementation scheme with only one 
pulsed laser source. The delay introduced by one arm of the 
interferometer is equal to the time difference between two con- 
secutive pulses. The polarization rotator R-450 changes the 
+45° linear polarization of the incoming pulses to —45° linear 
polarization. The intensity modulator (IM) blocks either all 
the even or all the odd optical pulses in mode a. 



well an intensity modulator (IM) to block either all the 
even or all the odd pulses in mode a (see Fig. [5]). The 
main reason for blocking half of these pulses is to sup- 
press possible correlations between them. That is, the 
action of the IM guarantees that the signals that go to 
Bob are precisely tensor product of states of the form 
given by Eq. (|6]). This way we can directly apply the se- 
curity evaluation provided in the previous section. This 
transmitter requires, therefore, an active control of the 
functioning of the IM. Note, however, that this configu- 
ration might still be much less of a problem than using a 
polarization modulator to actively generate BB84 signal 
states at high rates, since no RNG is needed to control 
the IM. Thanks to the one-pulse delay introduced by one 
arm of the interferometer, it can be shown that both 
setups in Fig. [2] and Fig. [5] are completely equivalent, ex- 
cept from the resulting secret key rate. More precisely, 
the secret key rate in the passive scheme with two lasers 
is double than that in the setup illustrated in Fig. [5j since 
half of the pulses are now discarded. 



To conclude, let us mention that similar ideas to the 
ones presented in this section can also be used in other 
implementations of the BB84 protocol with a different 
signal encoding. One example are those QKD experi- 
ments based on phase encoding, which turns out to be 
more suitable to use in combination with optical fibers 
than polarization encoding [l|. This situation is illus- 
trated in Fig. [BJ where now Alice uses a BS of very small 
transmittance (t <C 1) to split phase-randomized strong 
coherent pulses into two light beams. The strong beam 
is used to measure the value of its phase relative to some 
local reference phase by means of a phase measurement, 
while Alice sends the weak signal to Bob. Like in the pas- 
sive source shown in Fig. [21 Alice can select some valid re- 
gions for the measured phase, and the analysis presented 
before also applies straightforwardly to this scenario. 
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FIG. 6: Basic setup of a passive BB84 QKD phase encoding 
transmitter with strong coherent light. The mean photon 
number of the signal states psource can be chosen very high; 
for instance, « 10 s photons. 
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III. PASSIVE TRANSMITTER WITH SINGLE 
PHOTON SOURCES 



The passive state preparation schemes with coherent 
light introduced in the previous section deliver a key gen- 
eration rate of order 0(r]^ ys ), where T7 sys denotes the over- 
all transmittance of the system. To achieve higher secure 
key rates over longer distances there are two main alter- 
natives: To combine them with the decoy-state method 
03, or to employ SPS. In the first case, Alice can 
vary the mean photon number of the BB84 signals just 
by using a variable optical attenuator or a passive decoy- 
state setup [l4|. Here, we will concentrate on the second 
scenario, and we present a simple passive BB84 source 
which uses practical SPS. Note that the passive trans- 
mitters analyzed in Sec . [TT1 cannot be employed with SPS, 
since those setups need to operate with light pulses of 
sufficiently high intensity to be able to measure their po- 
larization with certain precision. 

The basic setup is illustrated in Fig. [7] It contains four 
light sources, each of them preparing a different BB84 
polarization state. The working principle of this device 
is rather simple. Let us first consider the ideal case. That 
is, each photon source in the figure emits precisely one 
single photon in the desired polarization state, and all 
detectors have perfect detection efficiency (?7det = 1) and 
dark count rate eA equal to zero. In this scenario, we 
have that whenever Alice observes a click in precisely 
three of the "signal detectors" D-a, Dy. and £>r, and 
no click in detector D (see Fig. [7]), the state generated 
by the source, that we shall denote as p ou t.j with j G 
{H, V,L,R}, consists of just one photon prepared in the 
polarization state associated with the signal detector Dj 
which did not click. For example, suppose that Alice 
obtains a click in detectors Dy, Dl, and -Dr,, and no click 
in detectors TDh and D, then the output state is given by 
Pout.H = |1, 0)j(l, 0|, where |1,0) ; denotes a Fock state 
with one photon in the horizontal polarization mode and 
zero photons in the vertical polarization mode. 

In order to evaluate the performance of this setup in 
a more realistic scenario, wc shall consider practical SPS 



FIG. 7: Basic setup of a passive BB84 QKD transmitter with 
practical SPS. Each laser diode emits pulses prepared in a 
different BB84 polarization state: H [horizontal], V [vertical] 
linear polarizations, and L [left], R [right] circular polariza- 
tions. The parameter t represents the transmittance of the 
BS's. All detectors shown in the figure denote threshold sin- 
gle photon detectors. 



emitting Fock diagonal states of the form 



n=0 



(14) 



with j 6 {H,V,L, R}. Furthermore, for simplicity, we 
assume that the photon number distribution p n of each 
source is the same for all them, independently of their 
polarization. 

To characterize the threshold single photon detectors 
£>h, Dy, £>l, -Dr, and D, we use a POVM with two 
elements, F vac and F c i ick , given by 



F mc = (l-c A )>"(l-»/det) n |n>H. 



(15) 



and -Fciick = 1 — -Fvac, where again the parameter rjdet 
denotes the detection efficiency of the detector, and eA 
represents its probability of having a dark count. We 
assume that £a is, to a good approximation, independent 
of the incoming signals. The outcome of F Yac corresponds 
to no click in the detector, while the operator fciick gives 
precisely one detection click, which means at least one 
photon is detected. 

After a tedious calculation, one can obtain the condi- 
tional output state p on t,j given that Alice observes a click 
only in three of the signal detectors Di and no click in 
detectors D and Dj (with j ^ i). A mathematical ex- 
pression for this state, together with its associated prob- 
ability, is given in Appendix [Cj 
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A. Lower bound on the secret key rate 

Like in Sec. Ill A[ the single photon signals emitted by 
the passive source illustrated in Fig. [7] are also basis- 
independent. To analyze the performance of this source 
we use again the security results provided by GLLP in 
Ref. Q. See also Ref. [l^. The secret key rate for- 
mula is given by Eq. (fTTj). Note, however, that such 
security analysis might overestimate the eavesdropping 
capabilities of Eve in this scenario even when Alice and 
Bob use one-way post-processing techniques during the 
public-discussion phase of the protocol. In contrast to 
the case analyzed in Sec. [TTl now multiphoton pulses can 
contain photons prepared in different polarization states. 
This effect, is similar to the one observed in those EB 
implementations of the BB84 protocol that use, for in- 
stance, a pulsed type-II down conversion source [22j . In 
this sense, the passive source shown in Fig. [7] might be 
more robust against the Photon Number Splitting (PNS) 
attack [23l | than an active one, since now Eve might not 
be able to obtain always full information about the part 
of the key generated with the multiphoton signals. Still, 
the multiphoton problem is now on Bob's side who gets 
a noisy signal, which can contain photons not prepared 
in Alice's state. The possibility to distill a secret key 
from multiphoton pulses in this situation constitutes an 
interesting theoretical question that deserves further in- 
vestigations, but it is beyond the scope of this paper. 

To evaluate the secret key rate formula given by 
Eq. (jTTJ) , we need to obtain the gain Q, the error rate 
E, and the multiphoton probability p mu iti of the source. 
These parameters are calculated in Appendix [D] For 
that, we use again the channel model and detection de- 
vice described in Appendix [Al The resulting lower bound 
on R is illustrated in Figs. [9j and [TOl for three differ- 
ent photon number distributions p n of the practical SPS. 
For simulation purposes, we use the same experimental 
data employed in Sec. Ill Al and we further assume that 
Alice's detectors have a dark count rate ea = 1 x 10 -6 . 

The first example plotted in Fig. [5] considers the case 
of perfect on-demand SPS, i.e., we impose p\ = 1 in 
Eq. HI]). We study three different situations, depending 
on the actual value of the efficiency r/A of Alice's detec- 
tors, and we optimize the transmittance t of the BS's 
on Alice's side for each case. In particular, we assume 
?/A = lj Va = 0.5, and 77 a = 0.1. This figure includes as 
well a lower bound on R when Alice employs an active 
source that emits single photon pulses (thick solid line). 
The cutoff points where the secret key rate drops down 
to zero are given by I ss 201.7 km (passive source with 
r/A = 1), I ~ 179.3 km (passive source with r/A = 0.5), 
I rj 162.5 km (passive source with r/A = 0.1), and I « 203 
km (active scheme). From the results shown in this fig- 
ure we see that, in this ideal scenario where pi = 1, the 
performance of the passive scheme is similar to the one of 
an active setup only when the efficiency of Alice's detec- 
tors is relatively high. Note that the difference between 
the achievable secret key rates in both scenarios comes 
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FIG. 8: Lower bound on the secret key rate R given by 
Eq. (|11[) in logarithmic scale for the passive setup illustrated 
in Fig. [7] with perfect on-demand SPS, i.e., pi — 1 in Eq. (|14[) . 
In the simulation we consider the following experimental pa- 
rameters: the dark count rate of Alice's and Bob's detectors 
is £a = £b = 1 x 10~ 6 , the overall transmittance of Bob's 
detection apparatus is j/b = 0.1, the loss coefficient of the 
channel is a — 0.2 dB/km, q — 1/2, and the efficiency of 
the error correction protocol is f(E) = 1.22. We further as- 
sume the channel model described in Appendix fS] where we 
neglect any misalignment effect. Otherwise, the actual se- 
cure distance will be smaller. The figure includes three cases, 
depending on the actual value of the efficiency 7/a of Alice's 
detectors, and we optimize the transmittance t of the BS's on 
Alice's side for each case. In particular, we assume r/A = 1 
(dashed line), 7/a = 0.5 (thin solid line), and r/A =0.1 (dash- 
dotted line). The solid line represents a lower bound on R 
when Alice employs an active source that emits single photon 
pulses with probability one. 



mainly from the probability p acc < 1 that Alice's trans- 
mitter produces a valid signal in the passive scheme (i.e., 
three of her signals detectors click). Specifically, when 
the efficiency r/A of Alice's detectors is too low, then also 
the probability p acc decreases significantly, and therefore 
the secret key rate decreases as well. The value of r/A 
also influences the resulting cutoff points for the secret 
key rate. For instance, when r/A decreases, the intrinsic 
noise of Alice's signals (i.e., the probability to produce a 
wrong signal) can increase due to the dark counts of her 
detectors. Note that this effect becomes more relevant 
for low r/A- As a result, the cutoff point for the secret 
key rate decreases. 

The other two examples illustrated in Figs. |9] and [10] 
analyze the influence that the vacuum and multiphoton 
probabilities of the practical SPS can have on the final 
secret key rate. For that, we consider two different pho- 
ton number distributions p n for the SPS described in 
Eq. (fT4")l . In particular, Fig. [5] shows the case where 
p a = 0.0099, pi = 0.9882, and p 2 = 1 - Po - Pi = 
0.0019, while Fig. CH assumes p = 0.2, Pl = 0.785, and 
P2 = 1 — po — Pi = 0.015. In both cases, we evaluate 
the same three scenarios contemplated in Fig. [5J i.e., we 
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FIG. 9: Lower bound on the secret key rate R given by 
Eq. f| 1 1 pi in logarithmic scale for the passive setup illustrated 
in Fig. with imperfect SPS. In particular, we consider that 
the photon number distribution p n of the sources is given by 
po = 0.0099, pi = 0.9882, and p 2 = 1 - p - pi = 0.0019. We 
further assume the same experimental data used in Fig. [8] We 
study three cases, depending on the actual value of the effi- 
ciency r]A of Alice's detectors, and we optimize the transmit- 
tance t of the BS's on Alice's side for each case. Specifically, 
we assume r]A = 1 (dashed line), t]a = 0.5 (thin solid line), 
and r/A =0.1 (dash-dotted line). The solid line represents a 
lower bound on R when Alice employs an active source with 
photon number distribution p n in combination with a BS. In 
this last case, we optimize the value of the transmittance of 
the BS as a function of the distance. 



consider t]a = 1, ?/a = 0.5, and t/a = 0.1. As expected, 
when the vacuum probability po augments, the proba- 
bility p aC c decreases and, therefore, the secret key rate 
decreases as well. Similarly, if the multiphoton prob- 
ability P2 increases, the intrinsic noise of Alice's signals 
also augments, and both the secret key rate and its cutoff 
point decreases. For comparison purposes, we consider as 
well the situation where Alice uses an active source (thick 
solid line) in combination with a BS whose transmittance 
is optimized with the distance. In this last case, the slope 
of the lower bound on R (when Alice employs an active 
setup) increases slightly when the transmittance of this 
additional BS starts to be less than one. This occurs, re- 
spectively, at I ~ 71 km (see Fig. [9]), and 1^22 km (see 
Fig. [TU]). From these results, we see that also in these 
two examples the performance of the passive scheme is 
comparable to the one of an active setup when 77A is suf- 
ficiently high. Furthermore, it is interesting to note that 
the distance covered by a passive transmitter might be 
even longer than the one of an active configuration for 
some values of the photon number distribution p n and of 
the parameter t]a (see, for instance, the dashed line in 
Fig. Let us emphasize, moreover, that, as discussed 
above, in our security analysis we assume that multipho- 
ton signals are always insecure (which is actually true 
only in the case of an active device), and, therefore, there 
might be still further room for improvement in the secret 
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FIG. 10: Lower bound on the secret key rate R given by 
Eq. (|11|) in logarithmic scale for the passive setup illustrated 
in Fig. [7] with imperfect SPS. The photon number distribu- 
tion p n of the sources is given by po = 0.2, pi = 0.785, and 
P2 = 1 — pa — Pi = 0.015. We further assume the same exper- 
imental data used in Fig. [8] We study three cases, depending 
on the actual value of the efficiency ija of Alice's detectors, 
and we optimize the transmittance t of the BS's on Alice's 
side for each case. In particular, we assume r]A — 1 (dashed 
line), 7?a = 0.5 (thin solid line), and r/A =0.1 (dash-dotted 
line). The solid line represents a lower bound on R when Al- 
ice employs an active source with photon number distribution 
p n in combination with a BS. In this last case, we optimize 
the value of the transmittance of the BS as a function of the 
distance. 

key rate which can be achieved with a passive device. 

The passive source shown in Fig. [7] might be an inter- 
esting alternative to implement the BB84 QKD proto- 
col with practical SPS. However, let us mention that to 
date there are still two main experimental challenges that 
need to be overcomed in order to obtain relevant secret 
key rates with such a device. On the one hand, we need 
to develop single photon detectors with high quantum 
efficiency that can operate at high clock rate. This rep- 
resents an interesting technological challenge, especially 
at telecom wavelengths where the efficiency of present- 
day single photon detectors lie typically at roughly 10- 
15%. In recent years, however, this field has advanced 
substantially and there are reasons to be optimistic; for 
instance, it has been shown lately that superconducting 
transition-edge sensor detectors can provide photon num- 
ber resolving capabilities at telecom wavelengths with 
95% efficiency and negligible noise [HI ■ At visible wave- 
lengths, silicon avalanche photodiodes (APD) arc already 
commercially available to offer high quantum efficiencies 
(up to about 70-80%) and low dark count rates. This last 
scenario, for example, is particularly relevant for free- 
space QKD. On the other hand, we need to design high- 
quality on-demand SPS. Note that the photon number 
statistics used for simulations purposes in this section 
assume on-demand SPS that are still beyond our present 
experimental capability [25| , For instance, the normal- 
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omit it for simplicity. The resulting secret key rate in this 
scenario, however, might be lower than that in the pas- 
sive setup analyzed in Sec. IIII1 since now the probability 
Pace to consider an output pulse as valid is also lower. 
Note that the passive scheme shown in Fig. [TT] has the 
additional requirement that each photon of a four-photon 
pulse needs to follow a different optical path, which is se- 
lected by means of 50 : 50 BS's. The photon number 
statistics of the output signals generated by both passive 
schemes are also different. 



IV. CONCLUSION 



FIG. 11: Alternative implementation scheme with only one 
photon source. The polarization rotators Rv, Rl, and Rn, 
change the horizontal polarization of the incoming pulses to 
vertical polarization, left circular polarization, and right cir- 
cular polarization, respectively. 



ized second-order correlation function and average 
photon number per pulse n of the sources used in Figs. [3] 
and [10] are, respectively, # (2) = 0.0039 and n = 0.992, 
and g( 2 ' = 0.0452 and n = 0.815. Despite the remark- 
able progress that has been made in recent years to gen- 
erate indistinguishable on demand single photons, nowa- 
days sub-Poissonian sources have a normalized second- 
order correlation function that lies typically between 0.05 
and 0.2 [2^]. However, the biggest experimental chal- 
lenge here is to increase the achievable collection effi- 
ciency, which is usually below 10%. This means that the 
probability to obtain an empty pulse is still rather high, 
and therefore n is relatively small (25[. As a result, the 
acceptance probability p acc of the passive BB84 source 
shown in Fig. [7] would be also quite small. Alternatively, 
one may use heralded SPS based on a parametric down 
conversion process, where the emission of an individual 
photon is heralded by the detection of the twin-photon 
[26l | . For instance, the photon number distributions of 
the sources used above can be generated with this type 
of sources. In this last case, however, the secret key rate 
formula should include an additional factor accounting 
for this detection probability. As a consequence, the fi- 
nal key rate can be substantially reduced. 

To conclude this section, let as mention that (as in 
Sec. Ill Bp instead of using the passive source illustrated 
in Fig. [7J Alice could as well employ, for instance, the 
alternative scheme illustrated in Fig. [TT] This setup is 
similar to the one shown in Fig. [7J but has only one 
photon source, which might make it more robust against 
side-channel attacks hidden in the imperfections of the 
light sources. The main idea is to replace four single- 
photon pulses (with different polarizations) emitted by 
four SPS by one four-photon pulse (with all their pho- 
tons prepared in the same polarization state) together 
with polarization rotators. The argumentation here goes 
similar to the passive device presented in Fig. [7J and we 



Typical experimental realizations of quantum key dis- 
tribution (QKD) protocols prepare the signal states by 
means of an active source. In this article, we have inves- 
tigated two different methods to passively generate the 
signal states of the Bennett-Brassard 1984 (BB84) QKD 
protocol. Our methods need only linear optical compo- 
nents and photodetectors, and represent an alternative to 
those active sources that use external-driven elements. 

In particular, we have showed that both coherent light 
and practical single photon sources are suitable for pas- 
sive generation of BB84 signals. In the asymptotic limit 
of an infinite long experiment, we have proved that the 
secret key rate delivered by a passive source with co- 
herent light is similar to the one provided by an active 
source, thus showing the practical interest of the passive 
scheme. When Alice uses practical single photon sources, 
we have showed that the distance covered by a passive 
transmitter might be longer than the one of an active 
configuration. This result is caused by the capacity of 
the passive scheme to reduce the number of multiphoton 
emissions of the source via a post-selection mechanism. 

The main focus of this paper has been polarization- 
based realizations of the BB84 protocol, which are par- 
ticularly relevant for free-space QKD. However, we have 
also showed that similar ideas can as well be applied to 
other practical scenarios with different signal encodings, 
like, for instance, those QKD experiments based on phase 
encoding, which are more suitable to use in combination 
with optical fibers. 
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Appendix A: Bob's detection setup and channel 
model 



In this Appendix we include a simple model to char- 
acterize Bob's detection device and the behavior of the 
quantum channel. This model is used in Sec. [TT] and 
Sec. IIIII to evaluate the performance of the two passive 
BB84 state preparation schemes that we present there. 

For simplicity, in our calculations we shall consider 
that Bob employs an active BB84 detection setup. Note, 
however, that the results contained in Sec. Inland Sec. IIIII 
can be straightforwardly adapted to cover as well the case 
where Bob uses a detection apparatus with passive basis 
choice [l2| . 

Specifically, we assume that Bob's detection scheme 
consists of a polarization analyzer and a polarization 
shifter which effectively changes the polarization basis 
of the subsequent measurement. The polarization an- 
alyzer has two detectors, each of them monitoring the 
output of a PBS. These detectors are characterized by 
their detection efficiency rj^et and their dark count rate 
Furthermore, we suppose that both detectors are 



27 



equal, and cannot distinguish the number of photons of 
arrival signals. They provide only two possible outcomes: 
"click" (at least one photon is detected), and "no click" 
(no photon is detected in the pulse). 

The action of such detection device can be described 
by two positive operator value measures (POVM), one 
for each of the two BB84 polarization bases (3 <G {l,c}, 
where I denotes a linear polarization basis and c is a 
circular polarization basis (2^|. Each POVM contains 
four elements: G^ ac , Gq, Gf, and G^ c . The outcome 
of the first operator, G^ ac , corresponds to no click in 
the detectors, the following two POVM operators, Gq 
and Gi , give precisely one detection click (these are the 
desired measurements), and the last one, G^ c , gives rise 



to both detectors being triggered, 
be written as 



These operators can 



G' 3 

vac 



fip — 
G{ = 
GL = 



[l-e B (2-e B )]if ac , 
(1 - e B )e B i^ ac + (1 - e B )if , 
(1 - e B )e B F v i c + (1 - e B )if , 
11 _ nP _ r<P — c 1 ^ 

31 ^vac ^0 "1 ' 



(Al) 



where the operators F^ ac , Fq , F^, and F? are defined 
below. Eq. (|Alj) assumes that the background rate, is, to 
a good approximation, independent of the signal detec- 
tion. Moreover, for easiness of notation, we only consider 
a background contribution coming from dark counts of 
Bob's detectors and we neglect other background contri- 
butions like, for instance, stray light arising from timing 
pulses which arc not completely filtered out in reception. 

The definition of the operators F^ ac , Fq , F-f , and F^ c 
includes as well the effect of the quantum channel. These 
operators characterize Bob's detection device, together 
with the action of the quantum channel, in the case of 



noiseless detectors. We consider a simple model of a 
quantum channel in the absence of eavesdropping; it just 
consists of a BS of transmittance ry c hannoi- For simplicity, 
here we neglect any misalignment effect in the channel. 
In this scenario, the operators F^ ac , Fq , F-f, and F^ c 
have the form EE [H 



OO 



FL = E (l- Vsys ) n+m \n,m) p (n,m\, 

n,m—0 
oo 

F o = E [l-(l-%y»H(l-'fay.) m |n J m) j8 <n J m|, 

n,m— 
oo 

if = J2 [l-(l-%ys) m ](l-% y sr|n,m)^n,m|, 



n,m— 
oo 

E 

n.m— 



f l = [l-a-^rni-a-rysysH 



x \n, m) ^{n, m\, 



(A2) 



with (3 £ {Z,c}. The signals |n, m) l (\n,m) c ) represent 
the state which has n photons in the horizontal (circular 
left) polarization mode and m photons in the vertical 
(circular right) polarization mode. The parameter ?7 sys 
denotes the overall transmittance of the system. This 
quantity can be written as 



^?sys — ^?channcl^7 B 7 



(A3) 



where ?; B denotes the overall transmittance of Bob's de- 
tection apparatus, i.e., ry B includes the transmittance of 
any optical component within Bob's measurement device 
together with the efficiency ?7det of his detectors. 

The parameter ^channel can be related with a trans- 
mission distance d measured in km for the given QKD 
scheme as 



??cha 



=1 = 10"-, 



(A4) 



where a represents the loss coefficient of the channel (e.g. 
free-space, or an optical fiber) measured in dB/km. 



Appendix B: Gain and QBER of a passive BB84 
QKD setup with coherent light 

In this Appendix, we calculate the observed gain Q and 
error rate E for the passive QKD device introduced in 
Sec.[n] For that, we use the channel model and detection 
apparatus described in Appendix lAl In the scenario con- 
sidered, it turns out that the gain is independent of the 
actual polarization of the signals p ut,e given by Eq. ([6]) 
and the basis (3 used to measure them. This parameter 
has the form 

= 1- Tr(Gi cPout , e ) = 1 - (1 - e B ) 2 e-^-, (Bl) 
for all and (3. 
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The calculation of E is slightly more involved, since 
the error rate varies depending on the value of the angle 
9. By symmetry, however, we can restrict ourselves to 
investigate the QBER in only one of the valid regions 
illustrated in Fig. [3] note that the error rate is the same 
in all of them. For instance, let us consider the case 
where 8 £ [7ir/4 + f2, ir/4 — Q] (which corresponds to the 
horizontal polarization interval), and let Eg denote the 
error rate of a signal state p ut,e in that region. This 
quantity can be written as 

Eg = Tr(G{p outt e) + ^Tr(G^ c p out , e ). (B2) 



and 



■^rj Bys IJ.(l + COs8) 



fdo,e = l + e-w-e 

■ 2 / \ 

_ p ->7sys/iSUi (|) 



The quantum bit error rate E is then given by 



E 



Eg dO, 



(B7) 



(B8) 



The first term in the summation represents the proba- 
bility that the signal hits the wrong detector on Bob's 
side, i.e., he observes a click in the detector associated 
with vertical polarization. The second term in Eq. (|B2[) 
is the probability to have a double click on his detection 
apparatus and assign to it a single click in the wrong de- 
tector. Using Eqs. (|A1|) - (|A2|) . we have that Eg can be 
further simplified as 



Eg 



where 



^{e B (e B - l)/o,e + [2 + CB(eB-3)]/i, fl 
[1 + e B (e B - 2)]/ dc>e + e B (2 - e B )}, (B3) 



fi t e = Tr(F/p out ,e), 



(B4) 




for all i £ {0, 1, dc}, and 9 £ [7tt/4 + 0, n/4-Q]. In order 
to calculate the probabilities f^g we use Eqs. ©-(O to 
first rewrite the state p ou t,9 given by Eq. (jSJ) as 



°° /x™ 1 ™ 
Pout,e = e-^^— 

n=0 k,k'=0 

x (l + e ^) fe (l + e -^) fe '(l- e ^)"- fe 

x (I - e- ie ) n ~ k ' \k,n - k)^' ,n - k'\, (B5) 

where \n, m) l represents again the state which has n pho- 
tons in the horizontal polarization mode and m in the 
vertical polarization mode. We obtain 



fo,6 
/i,s 



1 -f e 3>fcys/*( 1 + COBe ) 



and we solve this equation numerically. 

Appendix C: Conditional output state 



In this Appendix we provide a mathematical expres- 
sion for the conditional output state p ut,j introduced in 
Sec. IIIII together with its associated probability. This 
signal can be written as 



_j oo 

\ s n,m,k,l (r~*A \ 



n,m,k,l—0 



where the parameters q( n ,m,k,l) are S iven by q(», m ,k,i) = 
u„q m qkqi, with 



(l-e A )« n 5>*L- Ik 1 -^) 



x (1-t)] 



k—r 



(C2) 



and 



k—n 



\ k _ n ){^-t) k - n 1-(1-ca) 



X (1 - TJdet) 



k—n 



(C3) 



The states <7?' m ' ' have the form 



9 — (n+m)A — (k+l) k + l min{w+n,w'+n} min{k+l+m—w ,k+l+m—w'} 
n.m,k,l _ /-, \ ^ 4 \ ^ V - ^ V - ^ \r+s 

j - K 1 -^) n \ m \ km 1^ 9(n,m,k,l,w,w',r, s ){i--Vdet) 

w,iv'=0 r—0 s—0 



x h(n.7n,k,l.w,w'.r,s) | U> + n ~ r i & + I + m ~ W — s) ■ (w' + 71 — T, k + I + TTl — w' — s|, (C4) 
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where \n, m) ■ represents the state which has n photons in 
the polarization mode associated with the signal detector 
Dj which did not click, and m photons in its orthogonal 
polarization mode. The functions g( n , m,k, l,w,w',r,s) an d 
h( n ,m,k,i,w.w'.r,s) which appear in Eq. (|C4[) are defined, 
respectively, as 

9(n,m,k,l,w ,w' ,r,s) f(w,k,l)f(w',k,l)f(r,w,n)f(r,w',7i) 

X f(s,k+l-w,m)f(s,k+l-w',m)i (C5) 

with f( x , y , z ) given by 

min{a:,y} 



as 



s— max{0,x- z) 



y\ z 



si \ x — s 



(-iy- x+s , (C6) 



and 



h( n , m ,k,i,w,w',r,s) = r\s\yj (w + n - r)\^f(w' + n-r)\ 
x y/{k + l + m-w- s)\^(k + l + m- w' - s)!.(C7) 

The normalization factor TV of the output states p ou t,j 
does not depend on the parameter j. It can be calculated 

as 



^v= E ?K".,y)^K' roW ). (C8) 

n.m,k,l—0 



where the quantities Tr(<7™' m ' fc '') are given by 



n-(n+m)A-(.k+l) k + l w + n 



it?— r— 



fc+Z+m— w 



s=0 



X /l 



(n,m,k,l,w ,w ,r,s) ■ 



(C9) 



Q = l-Tr(Gl cPout ,,) = l 
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iV 



00 2^("+" l )4^( A; +0 k+l w+n 
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s=0 

9(n : m,k,l ,w,w,r,s) ^(n,m,k 7 l ,w,w,r,s) ? 



(Dl) 



for all j and j3. 

The QBER has also the same value for all possible 
polarization states p a ut,j emitted by Alice. Therefore, 
like in Appendix [B] in order to calculate it we can restrict 
ourselves to only one given polarization j. For instance, 
let us assume that the state produced by the source is 
Pout.H, that is, j = H. In this case, the error rate can be 
written as 



E = Tr(Gi/w, H ) + iTr(G^ c p outjH ), (D2) 



where the first term is the probability that the signal 
hits the wrong detector on Bob's side, and the second 
term denotes the probability to have a double click and 
assign to it a single click in the wrong detector. Like in 
Appendix |5] this quantity can be further simplified as 



E = ^{e B (e B -l)/o,H+ [2 + e B (e B -3)]/i,H 
+ [l + eB(eB-2)]/ dc ,H + e B (2-e B )}, (D3) 



where /;,h = Tr(i^p ut,H) for all i € {0, 1, dc}. The prob- 
abilities /^h can be obtained directly using Eqs. (|A2[1 - 
(|C1[) . In particular, we find that 



for all j . 

Finally, we have that the probability that Alice pro- 
duces a valid output state, i.e., only three of her signal 
detectors Di click and D does not click, that we shall 
denote as p a cc , is given by 



p acc = AN. 



(CIO) 



Appendix D: Gain, QBER, and multiphoton 
probability of a passive BB84 QKD setup with 
practical SPS 

It turns out that the gain of the protocol is independent 
of the polarization j of the signals p ut,j an d the basis /3 
used to measure them. This parameter can be expressed 
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/l,H = 



(1 _ £A ) ^ 2 -(™+ m )4-( fc +') 



E 



Q(n,m,k,l) ' 



n\m\k\l\ 



n,m,k,l—0 
k-\-l w-\-n k-\-l-\-m—w 

x EE E (i-% e tr +s (i-r7 Sys r + "- r 



w—0 r—0 s—0 



x [1 - (1 - r hys ) k+l+m - w - s 
x hi 



Isysj 

l(n,m,k,l,w,w,r,s) ? 



9{n,m : k : l,w,w,r,s) 



(D4) 
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and 



(1-ca) ^ 2 ^("+ m )4-( fe +" 

Jdc.H — ^7 Q(n,m,k,l)~ 



N 

n,m,k,L—0 
fe+i w-\-n k-\-l-\-m—w 

EE E a-**) 

m)=0 r=0 s=0 



r+s 



x [1 - (1 - r hys ) w+n - r }[l - (1 - ?/sys ) fc+ ' +m - lu -1 

Finally, the multiphoton probability of the source, 
Pmuitb is as well independent of the value of the polariza- 
tion j. It can be obtained as 

1 l-n 

Pmulti = 1 - E E Tr (K TO )j(™> m |Poutj) 
n— m— 

= 1 -Po,o,j -Po,i,j -Pi,o,j, (D6) 
where the probabilities p n , m ,j are defined as 

Pn,m,j = {n,m\p ovl t,i\ n -> m )j- ( D7 ) 
After a short calculation, we find that 

\ °° 2 — ( n + m )4 — 

P0,0,j = "TT E Q{n,m,k,l)- 



n\m\k\l\ 



rt .7n,k,l—0 
k+l 

x (l- £A )^;(l-r ?det )"+ m + fc + ! 



X /l 



(n,m,fc,Z,uj,r(j,iu+n,/c+/+m — 7 



(D8) 



= Jf E «(» 



.k.l) 



2—(n+m)A — (k+l) 
n\m\k\l\ 



n,m,k,l—0 

min{k+l,k+l+m-l} 
v \ /-i „ \n+m+fe+;— 1 

X (1 ^A)i7(n,m,fc,/,u;,u;,u'+n,/i:+/+m— 1) 



X /l 



(n,m : k : l,w ,w ,w-\-n : k J rl+m—w — l)'i 



(D9) 



and 



1 



E Q(n,m,k,l 



o — {n+m)£ — (k+l) 



n\m\k\l\ 

n,m,fc,^— 
k+l 

x ^ (1 - i lAct ) n+m+k+l - 1 

w — m ax { , 1 — n } 
^ (1 ^A)5 r (n,7n,fc, 2,10,1^,10+71— l,fc+/+m— w) 



X /l 



(D10) 
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